index.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"   
	"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
<!ENTITY author "<ulink url='mailto:johnson.AT.worldhello.net'>Johnson</ulink>">
<!ENTITY orgname "<ulink url='http://www.worldhello.net'>worldhello.net</ulink>">
<!ENTITY % vers   SYSTEM "version.xml">
%vers;
]>
<article id="index">
<articleinfo>
<title>PGP/GPG Howto</title>
<author><firstname>鑫</firstname><surname>蒋</surname></author>
<affiliation>
<orgname>&orgname;</orgname>
<address><email>johnson.AT.worldhello.net</email></address>
</affiliation>
<revhistory>
<!--revision>
<revnumber>$Revision$</revnumber>
<date>$Date$</date>
<authorinitials>$Author$</authorinitials>
<revremark>...</revremark>
</revision-->
<revision>
<revnumber>0.5</revnumber>
<date>2002/9/04</date>
<authorinitials>jiangxin</authorinitials>
<revremark>
<link linkend="pgpdisk">
增加用PGPDISK进行磁盘加密
</link>
</revremark>
</revision>
<revision>
<revnumber>0.4</revnumber>
<date>2002/9/03</date>
<authorinitials>jiangxin</authorinitials>
<revremark>
<link linkend="key-mangement">
增加PGP公钥管理
</link>
</revremark>
</revision>
<revision>
<revnumber>0.3</revnumber>
<date>2002/2/25</date>
<authorinitials>jiangxin</authorinitials>
<revremark>
<link linkend="faq-winxp">
Windows XP 和 PGP兼容性问题
</link>
</revremark>
</revision>
<revision>
<revnumber>0.2</revnumber>
<date>2002/2/22</date>
<authorinitials>jiangxin</authorinitials>
<revremark>
增加简介和PGP GUI和CLI共存
</revremark>
</revision>
<revision>
<revnumber>0.1</revnumber>
<date>2002/2/20</date>
<authorinitials>jiangxin</authorinitials>
<revremark>PGP/GPG Howto
</revremark>
</revision>
</revhistory>
<abstract>
<para>
PGP/GPG 是不对称加密、数字签名的经典和标准，不但可以为个人的数字传输提供信用保障，
用于保护个人之间通讯的隐私，保护敏感数据，而且可以在更大的范围内，如公司范围内的
数据加密，电子产品（软件）的数字签名，知识产权保护等。
</para>
<para>
本文介绍PGP/GPG软件的使用技巧等。
</para>
<para>
（编译自版本: &doc.revision;，最后更新时间: &doc.lastchange;）
</para>
</abstract>
</articleinfo>

<sect1 id="beginning"><title>不是多此一举</title>
<orderedlist>
<listitem>
<para>
一些废话
</para>
<para>
PGP/GPG作为数字签名软件的标准，已经存在多年。它不但可以为公司、个人之间重要
的隐私保护手段，更为重要的是，可以为我们出版的软件、内核等电子产品进行数字签名，
防止被篡改，最大程度保障了信息安全。
</para>
<para>
但是为防止公钥欺骗、保证公钥的不可否认性（Non-repudiation），我们需要一种机制
来管理和发布我们的公钥。
</para>
</listitem>
<listitem>
<para>
公钥的维护
</para>
<para>
可以将公钥用版本控制系统维护和收集，并定期更新到 FTP 服务器中发布。
</para>
</listitem>
<listitem>
<para>
注意事项
</para>
<itemizedlist>
<listitem>
<para>
建立有过期保护的公钥
</para>
<para>
加入过期机制，千万不要建立永不过期的公钥，以免私钥泄漏或丢失，想撤销公钥都不可能。
</para>
</listitem>
<listitem>
<para>
备份你的私钥
</para>
<para>
如果私钥丢失，则无法打开以前加密的文件。而且即使知道私钥被他人滥用，也无法使自己的公钥过期。
</para>
</listitem>
<listitem>
<para>
为私钥加上口令保护
</para>
<para>
这样即使私钥被人拷贝，还有一层保护啊。阿弥陀佛！
</para>
</listitem>
<listitem>
<para>
为公钥建立信任网络
</para>
<para>
由公司权威人士为大家的公钥签名并发布到网络签名的ldap公共服务器中。
对此权威人士公钥的信任，会自动验证其他人的公钥。
</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para>
资源列表
</para>
<itemizedlist>
<listitem>
<para>
PGP
</para>
<para>
<ulink url="http://www.pgpi.org/download/">下载</ulink>
</para>
</listitem>
<listitem>
<para>
GPG
</para>
<para>
<ulink url="http://www.gnupg.org/download.html">下载</ulink>
</para>
</listitem>
</itemizedlist>
</listitem>
</orderedlist>
</sect1>

<sect1 id="install"><title>安装</title>
<para>
在 BSD 上成功安装了 gpg 1.0.6；在 WINDOWS 2K 上实现了PGP命令行，PGP图形界
面，GPG 1.0.6的安装和共存。
</para>
<para>
建议在windows 2000上安装PGP 6.0.2版本，因为这是免费包含PGPDISK（加密磁盘）的最后一版。
</para>
<warning>
<para>
Windows XP 和 PGP 7.0.3 （for WIN2000） 存在严重的兼容性问题，甚至会导致系
统重装！安装前请参见 <link linkend='faq-winxp'>FAQ</link>。
</para>
<para>
PGP6.0.2 存在BUG：“Installation of Outlook Express plugin fails. （The OE plugin does not work with OE 5! ）”。
参见：<ulink url="http://www.pgpi.org/doc/bugs/win/">http://www.pgpi.org/doc/bugs/win/</ulink>
</para>
</warning>
</sect1>

<sect1 id="key-mangement"><title>PGP 公钥管理</title>
<para>
基于不对称加密的 PGP 加密、签名固然是安全的，但如何能够保障你获取的公钥就是其所声明的
本人的 KEY? 
</para>
<para>
PGP 的公钥，一般是保存在 Certserver 中，当 PGP 在需要时，会自动连接到服务器中获取。当然
还有一种方法，就是放在Web/Ftp服务器中，以只读方式下载获取。
</para>
<para>
当 import 一个人的公钥时，默认是不予信任，需要通过传统手段（电话、信件等）确认，然后在
对该公钥签名，完成对一个公钥的信任。对该公钥的签名可以是 public, 亦可以是 private 的。
</para>
<para>
当设置了一个KEY的信任度后，该KEY签署的KEY会被自动 valid。
</para>
<mediaobject>
<imageobject>
<imagedata fileref="images/keymangement.jpg" format="JPEG"/>
</imageobject>
<textobject>
<phrase>公钥管理</phrase>
</textobject>
<caption>
<para>
公钥管理示意图
</para>
</caption>
</mediaobject>

</sect1>

<sect1 id="mixup-pgp-gpg"><title>PGP GUI, PGP CLI, GPG共存</title>
<para>
图形化界面的优点是集成性、易用性好；命令行方式的WINDOWS版本同UNIX版本，
适合高级用户，适合自动化执行。
</para>
<para>
但基于如下原因，必须使用命令行。
</para>
<para>
图形界面的PGP不能用于商业应用，而GPG不受限制。
</para>
<para>
使用GnuPG(gpg)的目的也是源于此。由于RSA，IDEA等算法在美、加的专利注册，使得我们在商业场合使用公开的算法技术成为必须。而gpg在这方面做的最好。
</para>

<sect2><title>PGP GUI和CLI共存</title>
<orderedlist>
<listitem>
<para>
设置PGP命令行的主目录(适用于WINDOWS和UNIX)
</para>
<para>
PGP Command Line 6.5.8 for NT Freeware
</para>
<itemizedlist>
<listitem>
<para>
PGPPATH
</para>
<para>
The first time you start PGP, the software checks to see if the environment
variable PGPPATH is defined. If PGPPATH is defined, the software puts the
PGP preferences file, keyring files, pgp.cfg, and the randseed file in the
%PGPPATH% directory.
</para>
</listitem>
<listitem>
<para>
USERPROFILE
</para>
<para>
If PGPPATH is not defined, the software checks to see if the environment
variable USERPROFILE is defined. If USERPROFILE is defined, the software
puts the files in the %USERPROFILE%\Application Data\pgp directory.
</para>
<para>
If USERPROFILE is not defined, the software puts the files in
%SYSTEMROOT%\pgp.
</para>
<para>
The randseed file is always placed in the %SYSTEMROOT% directory on 
Windows NT, and "%PGPPATH%/randseed.rnd" on UNIX.
</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para>
PGP图形界面的主目录
</para>
<para>
PGPfreeware 7.0.3
</para>
<para>
通过 Options-->Files, 重新设置各个项的位置，使和命令行版本保持同一。
上述两个版本的PGP配置文件结构相同。这样很方便实现两者的同步。
</para>
<warning>
<para>
本人仅在PGPfreeware 7.0.3和PGP Command Line 6.5.8做过试验，请自行斟酌。
</para>
<para>
GPG配置文件和PGP不相同，切勿照此办理，后果自负。
</para>
</warning>
</listitem>
</orderedlist>
</sect2>

<sect2><title>PGP移植到GPG</title>
<orderedlist>
<listitem>
<para>
导入公钥
</para>
<screen>
$ pgp -kxa &lt;userid&gt; &gt; &lt;userid.asc&gt;
$ gpg --import &lt; &lt;userid.asc&gt;
</screen>
<para>
or
</para>
<screen>
$ pgp -kxa &lt;userid&gt; | gpg --import 
</screen>
<para>
测试
</para>
<screen>
$ echo 'Hello Friend!' | gpg -ear &lt;userid&gt;
</screen>
</listitem>
<listitem>
<para>
导入公钥和密钥
</para>
<itemizedlist>
<listitem>
<para>
导入公钥
</para>
<screen>
$ pgp -kx &lt;userid&gt; | gpg --import
</screen>
</listitem>
<listitem>
<para>
去掉PGP密钥的加密口令 (NO LONGER REQUIRED!)
</para>
<screen>
$ pgp -ke &lt;userid&gt;
</screen>
</listitem>
<listitem>
<para>
Export private key into GnuPG
</para>
<screen>
$ gpg --armor --export-secret-keys --secret-keyring ~/.pgp/secring.skr &lt;userid&gt; &gt; mykey.sec
$ gpg --import --allow-secret-key-import &lt; mykey.sec
</screen>
</listitem>
<listitem>
<para>
Set passphrase on both keys IMMEDIATELY 
</para>
<screen>
$ pgp -ke &lt;userid&gt;
$ gpg --edit-key &lt;userid&gt;
</screen>
</listitem>
<listitem>
<para>
Test key.
</para>
<screen>
$ echo 'hello world' | pgp -er &lt;userid&gt; | gpg --decrypt
</screen>
</listitem>
</itemizedlist>
</listitem>
</orderedlist>
</sect2>

<sect2><title>GPG移植到PGP</title>
<orderedlist>
<listitem>
<para>
去掉密钥口令加密
</para>
<screen>
$ gpg --edit-key &lt;user_id&gt;
gnupg&gt; passwd
Enter passphrase: *****
new passphrase:
reenter passphrase:
Are you sure you want to remove your passphrase? Y
gnupg&gt; save
</screen>
</listitem>
<listitem>
<para>
导出密钥
</para>
<screen>
$ gpg --export-secret-keys --armor --no-comment --output bad.asc
</screen>
</listitem>
<listitem>
<para>
重新为密钥加上口令
</para>
<screen>
$ gpg --edit &lt;user_id&gt;
   gnupg&gt; passwd
   You have no passphrase!
   new passphrase: *****
   reenter passphrase: *****
   gnupg&gt; save
</screen>
</listitem>
<listitem>
<para>
密钥导入到PGP
</para>
<para>
import bad.asc into PGP.
</para>
<screen>
$ pgp -ka bad.asc
</screen>
</listitem>
<listitem>
<para>
删除临时文件
</para>
<screen>
$ pgp -w bad.asc
</screen>
<note>
<para>
'-w' means safely wipe file. It is better than using rm.
</para>
</note>
</listitem>
<listitem>
<para>
为导入到PGP的KEY设置为绝对信任（implicit trust/
an ultimately-trusted introducer）。
</para>
<screen>
$ pgp -ke &lt;userid&gt;
</screen>
</listitem>
<listitem>
<para>
为PGP的密钥加入口令保护。
</para>
<screen>
$ pgp -ke &lt;userid&gt;
</screen>
</listitem>
</orderedlist>
</sect2>
</sect1>

<sect1 id="env"><title>环境配置</title>
<sect2><title>PGP (WIN2K+CYGWIN)</title>
<orderedlist>
<listitem>
<para>
环境变量
</para>
<itemizedlist>
<listitem>
<para>
TZ
</para>
<para>
时区设置：SET TZ=GMT-4
</para>
</listitem>
<listitem>
<para>
PGPPASS
</para>
<para>
密钥口令: SET PGPPASS=???????
</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para>
配置文件: <filename>pgp.cfg</filename>
</para>
<screen>
Armor = on
Armorlines = 0
Cert_depth = 3
ClearSig = on
KEYSERVER_URL = ldap://keyserver.pgp.com
#ENCRYPTTOSELF = on
#TZFIX=0
</screen>
</listitem>
</orderedlist>
</sect2>

<sect2><title>GPG (WIN2K+CYGWIN)</title>
<orderedlist>
<listitem>
<para>
环境变量
</para>
<itemizedlist>
<listitem>
<para>
注册表设置配置文件主目录
</para>
<para>
可设置注册表键值\\HKEY_CURRENT_USER\Software\GNU\GnuPG\HomeDir
为 C:/Documents and Settings/Administrator/Application Data/GPG，
则配置文件保存其中。
</para>
</listitem>
<listitem>
<para>
环境变量
</para>
<para>
可设置环境变量 GNUPGHOME=
C:/Documents and Settings/Administrator/Application Data/GPG
来改变缺省设置： ~/.gnupg。还可以通过设置注册表来完成。注册表优先。
</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para>
为右键菜单增加“GPG 签名”的命令
</para>
<para>
修改 HKEY_CLASSES_ROOT\*\shell\SigGPG， 增加 command 项，
默认设置为：<command>gpg -sba %1</command>。
</para>
</listitem>
<listitem>
<para>
配置文件: <filename>options</filename>
</para>
<screen>
# Options for GnuPG
# Copyright 1998, 1999, 2000, 2001 Free Software Foundation, Inc.
#
# This file is free software; as a special exception the author gives
# unlimited permission to copy and/or distribute it, with or without
# modifications, as long as this notice is preserved.
#
# This file is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# Unless you you specify which option file to use (with the
# commandline option "--options filename"), GnuPG uses the
# file ~/.gnupg/options by default.
#
# An option file can contain all long options which are
# available in GnuPG. If the first non white space character of
# a line is a '#', this line is ignored.  Empty lines are also
# ignored.
#
# See the man page for a list of options.

# Uncomment the next line to get rid of the copyright notice
#no-greeting

# If you have more than 1 secret key in your keyring, you may want
# to uncomment the following option and set your preffered keyid

#default-key 621CC013

# GnuPG ultimately trusts all keys in the secret keyring.  If you do
# not have all your secret keys online available you should use this
# option to tell GnuPG about ultimately trusted keys.
# You have to give the long keyID here which can be obtained by using
# the --list-key command along with the option --with-colons; you will
# get a line similiar to this one:
#    pub:u:1024:17:5DE249965B0358A2:1999-03-15:2006-02-04:59:f:
# the 5th field is what you want.

#trusted-key 12345678ABCDEF01


# If you do not pass a recipient to gpg, it will ask for one.
# Using this option you can encrypt to a default key.  key validation
# will not be done in this case.
# The second form uses the default key as default recipient.

#default-recipient some-user-id
#default-recipient-self


# The next option is enabled because this one is needed for interoperation
# with PGP 5 users.  To enable full OpenPGP compliance you have to remove
# this option.

force-v3-sigs

# Because some mailers change lines starting with "From " to "&gt;From "
# it is good to handle such lines in a special way when creating
# cleartext signatures; all other PGP versions do it this way too.
# To enable full OpenPGP compliance you have to remove this option.

escape-from-lines

# If you do not use the Latin-1 (ISO-8859-1) charset, you should
# tell GnuPG which is the native character set.  Please check
# the man page for supported character sets.
#charset utf-8


# You may define aliases like this:
#   alias mynames  -u 0x12345678 -u 0x456789ab -z 9
# everytime you use --mynames, it will be expanded to the options
# in the above defintion.  The name of the alias may not be abbreviated.
# NOTE: This is not yet implemented

# lock the file only once for the lifetime of a process.
# if you do not define this, the lock will be obtained and released
# every time it is needed - normally this is not needed.
lock-once

# If you have configured GnuPG without a random gatherer
# (./configure --enable-static-rnd=none), you have to
# uncomment _one_ of the following lines.  These
# extensions won't get used if you have a random gatherer
# compiled in (which is the default for GNU and xxxBSD systems)
#load-extension rndlinux
#load-extension rndunix
#load-extension rndegd


# GnuPG can import a key from a HKP keyerver if one is missing
# for certain operations. Is you set this option to a keyserver
# you will be asked in such a case whether GnuPG should try to
# import the key from that server (server do syncronize with each
# other and DNS Round-Robin may give you a random server each time).
# Use "host -l pgp.net | grep www" to figure out a keyserver.
#
# If you do not want to use the default port 11371, you can give the
# name of the keyserver like this:
#   x-hkp://keyserver.example.net:22742
# If you have problems connecting through a buggy proxy, you can use this:
#   x-broken-hkp://keyserver.example.net:11371
# But first you should make sure that you have read the man page regarding
# proxies (--honor-http-proxy)
# Most users just set the name of the preferred keyserver.
keyserver keyserver.pgp.com

# The environment variable http_proxy is only used when the
# this option is set.

honor-http-proxy


# added for PGP win95 support :-\                                                
cipher-algo CAST5
compress-algo 1

# It wasn't working with these two uncommented (Unix version of GnuPG) I don't
# know about the windows version.
#disable-cipher-algo BLOWFISH
#disable-cipher-algo TWOFISH

# The rest is not GnuPG option stuff but notes for GPG integration with other
# apps.
#=============================================================================
# The following macros were added to .muttrc to properly deal with clearsigned
# messages that procmail couldn't catch.
#macro pager S "|gpg --verify -\n" "Pipe text to GPG for verification."
#macro pager D "|gpg -d|less\n" "Pipe text to GPG for decryption."

# The following was added to .muttrc to support old PGP messages
# (Eudora/Outlook are retards when it comes to the de facto standard of
# PGP/MIME)
#macro compose S "Fgpg --clearsign\ny" "Clear sign an attachment."
#macro compose E "Fgpg -a --encrypt\ny" "Encrypt an atachmant."
#macro compose I "Fgpg -a --sign --encrypt\ny" "Encrypt and sign an atachmant."

# In your .muttrc make sure you don't have these two entires or Mutt won't
# handle them internaly:
#auto_view application/pgp-signature
#auto_view application/pgp
</screen>
</listitem>
</orderedlist>
</sect2>
</sect1>


<sect1 id="command"><title>命令参考</title>
<orderedlist>
<listitem>
<para>
管理KEY
</para>
<itemizedlist>
<listitem>
<para>
创建key
</para>
<screen>
pgp -kg &lt;userid&gt;
gpg --gen-key &lt;userid&gt;
</screen>
</listitem>
<listitem>
<para>
维护key
</para>
<screen>
pgp -ke &lt;userid&gt;
gpg --edit-key &lt;userid&gt;
gpg --delete-key &lt;userid&gt;
gpg --delete-secret-key &lt;userid&gt;
gpg -keyserver ldap://keyserver.pgp.com -send-key &lt;userid&gt;
gpg --s2k-cipher-algo CAST5 --s2k-digest-algo SHA1 --compress-algo 1 --edit-key &lt;userid&gt;
gpg --sign-key &lt; UID &gt; 
gpg --sign-key &lt; UID &gt; 
</screen>
</listitem>
<listitem>
<para>
查看key属性
</para>
<screen>
pgp -kv  &lt;userid&gt;
pgp -kvv &lt;userid&gt;
pgp -kvc &lt;userid&gt;
gpg --list-keys
gpg --list-sigs
gpg --fingerprint
gpg --list-secret-keys
</screen>
</listitem>
<listitem>
<para>
导入导出key
</para>
<screen>
pgp -ka &lt;keyfile&gt;
pgp -kx &lt;userid&gt; &lt;keyfile&gt; &lt;keyring&gt;
gpg --import [--allow-secret-key-import] &lt;keyfile&gt;
gpg --export &lt;userid&gt;
gpg --export-secret-keys -a &lt;userid&gt;
</screen>
</listitem>
</itemizedlist>
</listitem>

<listitem>
<para>
签名和验证
</para>
<screen>
pgp -sba &lt;file&gt; [-u yourid]
pgp &lt;file.asc&gt;
gpg -sba [--force-v3-sigs] &lt;file&gt;  [-u yourid]
gpg &lt;file.asc&gt;
</screen>
</listitem>
<listitem>
<para>
加密和解密
</para>
<screen>
pgp -ew  &lt;file&gt; &lt;userid ...&gt;	# 加密并删除原文
pgp -esa &lt;file&gt; &lt;userid ...&gt;	# 加密并签名
pgp &lt;file.asc&gt; [-o output_file]
gpg -ea &lt;file&gt; -r &lt;userid ...&gt;
gpg --compress-algo 1 --cipher-algo cast5 -e &lt;file&gt; -r &lt;userid ...&gt;
gpg --armor [-u sender] [--recipient userid ...] [--sign] [--output outputfile] --encrypt &lt;file&gt; 
gpg [-d] &lt;file.asc&gt; [-o output_file]
</screen>
</listitem>
</orderedlist>
</sect1>


<sect1 id="pgpdisk"><title>用PGPDISK进行磁盘加密</title>
<para>
可以用 PGPDISK 将加密文件模拟成一个加密磁盘分区来管理，也许还有其它软件，
但 PGPDISK 是最方便的一个。PGPDISK 其实和 PGP 无关，只是生拉硬拽到 PGP 
的软件包中。PGP 6.0.2 是免费包含PGPDISK（加密磁盘）的最后一版，之后的
版本的PGPDISK 作为商业软件要收费。
</para>
<mediaobject>
<imageobject>
<imagedata fileref="images/pgpdisk1.jpg" format="JPEG"/>
</imageobject>
<textobject>
<phrase>PGPDISK加密磁盘文件示意</phrase>
</textobject>
<caption>
<para>
PGPDISK加密磁盘文件示意
</para>
</caption>
</mediaobject>
<mediaobject>
<imageobject>
<imagedata fileref="images/pgpdisk2.jpg" format="JPEG"/>
</imageobject>
<textobject>
<phrase>PGPDISK加密磁盘文件的口令保护</phrase>
</textobject>
<caption>
<para>
PGPDISK加密磁盘文件的口令保护
</para>
</caption>
</mediaobject>
<mediaobject>
<imageobject>
<imagedata fileref="images/pgpdisk3.jpg" format="JPEG"/>
</imageobject>
<textobject>
<phrase>为加密PGPDISK文件分配盘符</phrase>
</textobject>
<caption>
<para>
为加密PGPDISK文件分配盘符
</para>
</caption>
</mediaobject>
</sect1>

<sect1 id="faq"><title>FAQ</title>
<qandaset defaultlabel='number'>
<qandaentry>
<question>
<para>
<anchor id="faq-winxp"/>
PGP 7.03 GUI和 Win XP不兼容么？
</para>
</question>
<answer>
<para>
I had the same problem after installing 7.03 on my XP machine. No need to 
reinstall XP. Go to System Restore and click on "Restore my computer to an 
earlier time". Choose a time and date that is earlier than the date when you 
installed PGP 7.03, and then click Next. 
</para>
<para>
Checked with Microsoft and it isn't compatible at all with WinXP. If you 
installed the IPSEC functionality you have to back out to the previous good 
configuration, uninstall won't cut it. 
</para>
</answer>
</qandaentry>
<qandaentry>
<question>
<para>
如何成功在 Win XP 安装 PGP 7.0.3 ?
</para>
</question>
<answer>
<para>
I appreciate the posts that you all have provided here... I was having the 
same networking snafu that a few of you described: Here's how I've got PGP and 
WinXP to work: 
</para>
<para>
I upgraded from Win98 -> WinXP. The first time I did, I already had PGP 7.0.3 
installed on my box. When XP booted, I had the "cannot establish link to 
pgpsdk service" message... couldn't for the life of me get rid of it. Tried to 
remove/re-install PGP which proceeded to cut off my network connection. I had 
to back all the way back to Win98 to restore my network connection. 
</para>
<para>
Here's how I got it right: 
</para>
<orderedlist>
<listitem>
<para>
Uninstalled PGP FIRST, *before* upgrading to XP. 
</para>
</listitem>
<listitem>
<para>
Upgraded to XP. 
</para>
</listitem>
<listitem>
<para>
Installed PGP... but here's the key, UNCHECK the Personal Firewall/VPN/etc. 
option in the setup. (I think it's the first one on the list of installable 
options) I think that's the thing that caused me the most trouble... 
</para>
</listitem>
<listitem>
<para>
Install as normal... I hope that helps some of you. 
</para>
</listitem>
</orderedlist>
</answer>
</qandaentry>
</qandaset>
</sect1>

</article>